fix: 修复文件预览重定向与扩展名解析

server/db/mysql/adapter.go

@@ -72,6 +72,27 @@ func quoteIdent(name string) string {
 	return "`" + strings.ReplaceAll(name, "`", "``") + "`"
 }
 
+func parseFileUID(fid string) t.Uid {
+	name := strings.TrimSpace(fid)
+	id := t.ParseUid(name)
+	if !id.IsZero() {
+		return id
+	}
+	if dot := strings.LastIndexByte(name, '.'); dot > 0 {
+		ext := name[dot+1:]
+		if len(ext) == 0 || len(ext) > 16 {
+			return t.ZeroUid
+		}
+		for _, r := range ext {
+			if (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') && (r < '0' || r > '9') {
+				return t.ZeroUid
+			}
+		}
+		return t.ParseUid(name[:dot])
+	}
+	return t.ZeroUid
+}
+
 type configType struct {
 	// DB connection settings.
 	// See https://pkg.go.dev/github.com/go-sql-driver/mysql#Config
@@ -4994,7 +5015,7 @@ func (a *adapter) FileFinishUpload(fd *t.FileDef, success bool, size int64) (*t.
 
 // FileGet fetches a record of a specific file
 func (a *adapter) FileGet(fid string) (*t.FileDef, error) {
-	id := t.ParseUid(fid)
+	id := parseFileUID(fid)
 	if id.IsZero() {
 		return nil, t.ErrMalformed
 	}
@@ -5188,7 +5209,7 @@ func (a *adapter) FileUserHasAccess(fid string, uid t.Uid) (bool, error) {
 	if uid.IsZero() {
 		return false, t.ErrMalformed
 	}
-	fileID := t.ParseUid(fid)
+	fileID := parseFileUID(fid)
 	if fileID.IsZero() {
 		return false, t.ErrMalformed
 	}